// roles/entra

Teams AdministratorMicrosoft Entra built-in role

Can manage the Microsoft Teams service.

Role ID	`69091246-20e8-4a56-aa4d-066075b2a7a8`
Privileged	No
Permissions	33

What it can do

Permission	What it allows
`microsoft.azure.serviceHealth/allEntities/allTasks`	Read and configure Azure Service Health
`microsoft.azure.supportTickets/allEntities/allTasks`	Create and manage Azure support tickets
`microsoft.directory/authorizationPolicy/standard/read`	Read standard properties of authorization policy
`microsoft.directory/crossTenantAccessPolicy/allowedCloudEndpoints/update`	Update allowed cloud endpoints of cross-tenant access policy
`microsoft.directory/crossTenantAccessPolicy/default/crossCloudMeetings/update`	Update cross-cloud Teams meeting settings of the default cross-tenant access policy
`microsoft.directory/crossTenantAccessPolicy/default/standard/read`	Read basic properties of the default cross-tenant access policy
`microsoft.directory/crossTenantAccessPolicy/partners/create`	Create cross-tenant access policy for partners
`microsoft.directory/crossTenantAccessPolicy/partners/crossCloudMeetings/update`	Update cross-cloud Teams meeting settings of cross-tenant access policy for partners
`microsoft.directory/crossTenantAccessPolicy/partners/standard/read`	Read basic properties of cross-tenant access policy for partners
`microsoft.directory/crossTenantAccessPolicy/standard/read`	Read basic properties of cross-tenant access policy
`microsoft.directory/externalUserProfiles/basic/update`	Update basic properties of external user profiles in the extended directory for Teams
`microsoft.directory/externalUserProfiles/delete`	Delete external user profiles in the extended directory for Teams
`microsoft.directory/externalUserProfiles/standard/read`	Read standard properties of external user profiles in the extended directory for Teams
`microsoft.directory/groups.unified/assignedLabels/update`	Update the assigned labels property on Microsoft 365 groups of assigned membership type, excluding role-assignable groups
`microsoft.directory/groups.unified/basic/update`	Update basic properties on Microsoft 365 groups, excluding role-assignable groups
`microsoft.directory/groups.unified/create`	Create Microsoft 365 groups, excluding role-assignable groups
`microsoft.directory/groups.unified/delete`	Delete Microsoft 365 groups, excluding role-assignable groups
`microsoft.directory/groups.unified/members/update`	Update members of Microsoft 365 groups, excluding role-assignable groups
`microsoft.directory/groups.unified/owners/update`	Update owners of Microsoft 365 groups, excluding role-assignable groups
`microsoft.directory/groups.unified/restore`	Restore Microsoft 365 groups from soft-deleted container, excluding role-assignable groups
`microsoft.directory/groups/hiddenMembers/read`	Read hidden members of Security groups and Microsoft 365 groups, including role-assignable groups
`microsoft.directory/pendingExternalUserProfiles/basic/update`	Update basic properties of external user profiles in the extended directory for Teams
`microsoft.directory/pendingExternalUserProfiles/create`	Create external user profiles in the extended directory for Teams
`microsoft.directory/pendingExternalUserProfiles/delete`	Delete external user profiles in the extended directory for Teams
`microsoft.directory/pendingExternalUserProfiles/standard/read`	Read standard properties of external user profiles in the extended directory for Teams
`microsoft.directory/permissionGrantPolicies/standard/read`	Read standard properties of permission grant policies
`microsoft.office365.network/performance/allProperties/read`	Read all network performance properties in the Microsoft 365 admin center
`microsoft.office365.serviceHealth/allEntities/allTasks`	Read and configure Service Health in the Microsoft 365 admin center
`microsoft.office365.skypeForBusiness/allEntities/allTasks`	Manage all aspects of Skype for Business Online
`microsoft.office365.supportTickets/allEntities/allTasks`	Create and manage Microsoft 365 service requests
`microsoft.office365.usageReports/allEntities/allProperties/read`	Read Office 365 usage reports
`microsoft.office365.webPortal/allEntities/standard/read`	Read basic properties on all resources in the Microsoft 365 admin center
`microsoft.teams/allEntities/allProperties/allTasks`	Manage all resources in Teams

Assign it

The role ID is the same in every tenant, so these work as they are. Make it eligible through PIM:

powershell13 lines

1
2
3
4
5
6
7
8
9
10
11
12
13Connect-MgGraph -Scopes "RoleEligibilitySchedule.ReadWrite.Directory"
$user = Get-MgUser -UserId "jane.doe@contoso.com"
New-MgRoleManagementDirectoryRoleEligibilityScheduleRequest -BodyParameter @{
    Action           = "AdminAssign"
    Justification    = "Needs Teams Administrator for <reason>"
    RoleDefinitionId = "69091246-20e8-4a56-aa4d-066075b2a7a8"
    DirectoryScopeId = "/"
    PrincipalId      = $user.Id
    ScheduleInfo     = @{
        StartDateTime = (Get-Date).ToUniversalTime().ToString("o")
        Expiration    = @{ Type = "afterDuration"; Duration = "P180D" }
    }
}

Who already has it?

powershell3 lines

1
2
3Connect-MgGraph -Scopes "RoleManagement.Read.Directory"
Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq '69091246-20e8-4a56-aa4d-066075b2a7a8'" -ExpandProperty Principal |
    ForEach-Object { $_.Principal.AdditionalProperties.displayName }

Related roles

SharePoint Advanced Management Administrator · 28 permissions
Windows 365 Administrator · 28 permissions
SharePoint Administrator · 27 permissions
Groups Administrator · 26 permissions
Exchange Administrator · 25 permissions
Global Secure Access Administrator · 20 permissions
Authentication Policy Administrator · 19 permissions
Guest Inviter · 17 permissions

Find the smallest role for a task →

Sources

Microsoft Learn: Microsoft Entra built-in roles